Make 'credentials' configurable for GQL requests

[vincenzo]

This PR fixes #364

The cause of the issue

The issue was due to this. Tim must've commented that out because having credentials: "include" by default is not best practice, as it breaks requests to any server that does not have the correct cors options set up. Specifically, a server must know the domains of all the requesters in advance when credentials: "include".

The proposed change

The change proposed here is very simple:

• I have added request.credentials: "omit" to the default settings
• The new option only affects the fetch() call used to "post" GraphQL queries/mutations to the server

By having "omit" as a default setting, I preserve the current behaviour: no request will be broken due to lack of the correct cors options server-side.

Additionally, request.credentials can take all the values that credentials for fetch() takes:

• "omit"
• "include"
• "same-origin"

Of course, one must know what they are doing, as the server must have cors enabled and correctly configured. The same-origin value comes in handy for those project like the one I am working on right now, where we use an express middleware, so client and server are on the same domain. Also, our official "client", when ready, will also be living on the same domain. The include value can be set for all other scenarios where the client lives on a different domain than the server and one can tell the server what "client domains" to allow.

Tested

I have tested this locally pointing the react app to my server (correctly configured for each of the credentials values) and all seems to be working just fine.

Potential improvements

• It might be that Settings is not exactly the best place to put this setting in, but I do believe that it is a good enough choice for the time being.

• Expose the settings to the middlewares so that they can instantiate the Playground with the option for "credentials" that it is best for their project.

[CLAassistant]

All committers have signed the CLA.

[vincenzo]

@timsuchanek @HuVik Is the playground-build broken per se, or am I breaking it? /cc @kbrandwijk

[huv1k]

It was broken before, i think here 300f250

[vincenzo]

Did you have little time to check this out, @timsuchanek?

[timsuchanek]

It was already broken, but I'm fixing it right now. Thanks for the PR!

[vincenzo]

Thank you for merging it, Tim!

[gajus]

It appears that the parameters passed via init are being ignored.

#791

[valnub]

I think this should be set to include by default.
I just spent 3 hours banging my head against the desk as I couldn't access my session objects just to find out that the client didn't send the session cookie 😞

[freddyfallon]

@vincenzo you legend this is dope.